Refactored to be more modular

server/TASK.md

···
+- [ ] Modularize server entrypoint: extract routing, handlers, and templates

server/config/config.go

···
+package config
+
+import "os"
+
+// Config aggregates server configuration derived from environment variables.
+type Config struct {
+    Port         string
+    ClientURI    string
+    CookieSecret string
+    DevOffline   bool
+}
+
+// FromEnv reads process environment variables and returns a Config populated
+// with defaults that mirror the previous hard-coded values in main.
+func FromEnv() Config {
+    port := getEnv("PORT", "80")
+    clientURI := getEnv("CLIENT_URI", "http://localhost:"+port)
+    cookieSecret := getEnv("COOKIE_SECRET", "your-secret-key")
+    devOffline := getEnv("DEV_OFFLINE", "") == "1"
+
+    return Config{
+        Port:         port,
+        ClientURI:    clientURI,
+        CookieSecret: cookieSecret,
+        DevOffline:   devOffline,
+    }
+}
+
+func getEnv(key, def string) string {
+    if v := os.Getenv(key); v != "" {
+        return v
+    }
+    return def
+}

server/devstore/store.go

···
+package devstore
+
+import "sync"
+
+// Doc represents a document stored in the in-memory development store.
+type Doc struct {
+    ID        string
+    Name      string
+    Text      string
+    UpdatedAt string
+}
+
+// Store keeps per-session document maps for DEV_OFFLINE mode.
+type Store struct {
+    mu    sync.Mutex
+    store map[string]map[string]*Doc
+}
+
+// New creates an empty Store.
+func New() *Store {
+    return &Store{store: make(map[string]map[string]*Doc)}
+}
+
+// GetSession returns the document map for the given session ID, creating it on demand.
+func (s *Store) GetSession(sessionID string) map[string]*Doc {
+    s.mu.Lock()
+    defer s.mu.Unlock()
+    docs, ok := s.store[sessionID]
+    if !ok {
+        docs = make(map[string]*Doc)
+        s.store[sessionID] = docs
+    }
+    return docs
+}
+
+// DeleteSession removes the document map for a session.
+func (s *Store) DeleteSession(sessionID string) {
+    s.mu.Lock()
+    delete(s.store, sessionID)
+    s.mu.Unlock()
+}

server/handlers/docs/handler.go

···
+package docs
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/johnluther/tap-editor/server/devstore"
+	"github.com/johnluther/tap-editor/server/session"
+	fountain "github.com/johnluther/tap-editor/server/tap-editor"
+)
+
+// FetchDocFunc retrieves the name and text for a document by rkey.
+type FetchDocFunc func(http.ResponseWriter, *http.Request, context.Context, session.Session, string) (string, string, int, error)
+
+// RenderPDFFunc renders fountain blocks into PDF bytes.
+type RenderPDFFunc func([]fountain.Block, string) ([]byte, error)
+
+// UploadBlobFunc uploads a blob to the user's PDS.
+type UploadBlobFunc func(http.ResponseWriter, *http.Request, []byte) (*http.Response, error)
+
+// PDSRequestFunc issues an authenticated request to the user's PDS.
+type PDSRequestFunc func(http.ResponseWriter, *http.Request, string, string, string, []byte) (*http.Response, error)
+
+// PDSBaseFunc returns the base URL for the user's PDS.
+type PDSBaseFunc func(*http.Request) string
+
+// GetSessionFunc returns the user's DID and handle.
+type GetSessionFunc func(*http.Request) (string, string, bool)
+
+// SessionIDFunc returns the session ID for the request, creating one if needed.
+type SessionIDFunc func(http.ResponseWriter, *http.Request) string
+
+// SanitizeFilenameFunc cleans a string for safe filesystem usage.
+type SanitizeFilenameFunc func(string) string
+
+// Dependencies aggregates collaborators required by the docs handler.
+type Dependencies struct {
+	DevStore            *devstore.Store
+	DevOffline          func() bool
+	GetSessionID        SessionIDFunc
+	GetDIDAndHandle     GetSessionFunc
+	UploadBlobWithRetry UploadBlobFunc
+	PDSRequest          PDSRequestFunc
+	PDSBase             PDSBaseFunc
+	RenderPDF           RenderPDFFunc
+	FetchDoc            FetchDocFunc
+	SanitizeFilename    SanitizeFilenameFunc
+	MaxJSONBody         int64
+	MaxTextBytes        int
+}
+
+// Handler serves document endpoints backed by ATProto or an in-memory dev store.
+type Handler struct {
+	deps Dependencies
+}
+
+// New constructs a Handler with the given dependencies.
+func New(deps Dependencies) *Handler {
+	return &Handler{deps: deps}
+}
+
+// Register attaches document routes to the mux.
+func (h *Handler) Register(mux *http.ServeMux) {
+	mux.HandleFunc("/docs", h.handleDocs)
+	mux.HandleFunc("/docs/", h.handleDocByID)
+}
+
+// DocsHandler exposes the main docs collection handler.
+func (h *Handler) DocsHandler() http.HandlerFunc {
+	return h.handleDocs
+}
+
+// DocByIDHandler exposes the per-document handler.
+func (h *Handler) DocByIDHandler() http.HandlerFunc {
+	return h.handleDocByID
+}
+
+func (h *Handler) handleDocs(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	if h.deps.DevOffline() {
+		sid := h.deps.GetSessionID(w, r)
+		store := h.deps.DevStore.GetSession(sid)
+		switch r.Method {
+		case http.MethodGet:
+			type item struct {
+				ID        string `json:"id"`
+				Name      string `json:"name"`
+				UpdatedAt string `json:"updatedAt"`
+			}
+			out := make([]item, 0, len(store))
+			for _, d := range store {
+				out = append(out, item{ID: d.ID, Name: d.Name, UpdatedAt: d.UpdatedAt})
+			}
+			_ = json.NewEncoder(w).Encode(out)
+			return
+		case http.MethodPost:
+			r.Body = http.MaxBytesReader(w, r.Body, h.deps.MaxJSONBody)
+			var body struct{ Name, Text string }
+			if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+				http.Error(w, "invalid json", http.StatusBadRequest)
+				return
+			}
+			if body.Name == "" {
+				body.Name = "Untitled"
+			}
+			rb := make([]byte, 8)
+			_, _ = rand.Read(rb)
+			id := "d-" + hex.EncodeToString(rb)
+			now := time.Now().UTC().Format(time.RFC3339)
+			store[id] = &devstore.Doc{ID: id, Name: body.Name, Text: body.Text, UpdatedAt: now}
+			w.WriteHeader(http.StatusCreated)
+			_ = json.NewEncoder(w).Encode(map[string]string{"id": id})
+			return
+		default:
+			w.WriteHeader(http.StatusMethodNotAllowed)
+			return
+		}
+	}
+
+	did, _, ok := h.deps.GetDIDAndHandle(r)
+	if !ok {
+		w.WriteHeader(http.StatusNoContent)
+		return
+	}
+
+	switch r.Method {
+	case http.MethodGet:
+		url := h.deps.PDSBase(r) + "/xrpc/com.atproto.repo.listRecords?repo=" + did + "&collection=lol.tapapp.tap.doc&limit=100"
+		resp, err := h.deps.PDSRequest(w, r, http.MethodGet, url, "", nil)
+		if err != nil {
+			http.Error(w, "list failed", http.StatusBadGateway)
+			return
+		}
+		defer resp.Body.Close()
+		if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+			w.WriteHeader(resp.StatusCode)
+			return
+		}
+		var lr struct {
+			Records []map[string]any `json:"records"`
+		}
+		if err := json.NewDecoder(resp.Body).Decode(&lr); err != nil {
+			http.Error(w, "decode list", http.StatusBadGateway)
+			return
+		}
+		type item struct {
+			ID        string `json:"id"`
+			Name      string `json:"name"`
+			UpdatedAt string `json:"updatedAt"`
+		}
+		out := make([]item, 0, len(lr.Records))
+		for _, rec := range lr.Records {
+			val, _ := rec["value"].(map[string]any)
+			name := firstNonEmpty(val["name"], val["title"], "Untitled")
+			updatedAt := normalizeTime(firstNonEmpty(val["updatedAt"], val["updated"], rec["indexedAt"]))
+			id := extractID(rec)
+			out = append(out, item{ID: id, Name: name, UpdatedAt: updatedAt})
+		}
+		_ = json.NewEncoder(w).Encode(out)
+	case http.MethodPost:
+		r.Body = http.MaxBytesReader(w, r.Body, h.deps.MaxJSONBody)
+		var body struct{ Name, Text string }
+		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+			http.Error(w, "invalid json", http.StatusBadRequest)
+			return
+		}
+		if len(body.Text) > h.deps.MaxTextBytes {
+			http.Error(w, "text too large", http.StatusRequestEntityTooLarge)
+			return
+		}
+		if body.Name == "" {
+			body.Name = "Untitled"
+		}
+		bRes, err := h.deps.UploadBlobWithRetry(w, r, []byte(body.Text))
+		if err != nil {
+			http.Error(w, "blob upload failed", http.StatusBadGateway)
+			return
+		}
+		defer bRes.Body.Close()
+		var bOut struct {
+			Blob map[string]any `json:"blob"`
+		}
+		if err := json.NewDecoder(bRes.Body).Decode(&bOut); err != nil {
+			http.Error(w, "blob decode failed", http.StatusBadGateway)
+			return
+		}
+		rb := make([]byte, 8)
+		_, _ = rand.Read(rb)
+		id := "d-" + hex.EncodeToString(rb)
+		record := map[string]any{"$type": "lol.tapapp.tap.doc", "name": body.Name, "contentBlob": bOut.Blob, "updatedAt": time.Now().UTC().Format(time.RFC3339Nano)}
+		payload := map[string]any{"repo": did, "collection": "lol.tapapp.tap.doc", "rkey": id, "record": record}
+		buf, _ := json.Marshal(payload)
+		createURL := h.deps.PDSBase(r) + "/xrpc/com.atproto.repo.createRecord"
+		cr, err := h.deps.PDSRequest(w, r, http.MethodPost, createURL, "application/json", buf)
+		if err != nil {
+			http.Error(w, "create failed", http.StatusBadGateway)
+			return
+		}
+		defer cr.Body.Close()
+		if cr.StatusCode < 200 || cr.StatusCode >= 300 {
+			w.WriteHeader(cr.StatusCode)
+			return
+		}
+		w.WriteHeader(http.StatusCreated)
+		_ = json.NewEncoder(w).Encode(map[string]string{"id": id})
+	default:
+		w.WriteHeader(http.StatusMethodNotAllowed)
+	}
+}
+
+func (h *Handler) handleDocByID(w http.ResponseWriter, r *http.Request) {
+	if h.deps.DevOffline() {
+		h.handleDevDoc(w, r)
+		return
+	}
+
+	did, handle, ok := h.deps.GetDIDAndHandle(r)
+	if !ok {
+		w.Header().Set("Content-Type", "application/json; charset=utf-8")
+		w.WriteHeader(http.StatusNoContent)
+		return
+	}
+
+	id := strings.TrimPrefix(r.URL.Path, "/docs/")
+	if id == "" {
+		w.Header().Set("Content-Type", "application/json; charset=utf-8")
+		w.WriteHeader(http.StatusBadRequest)
+		return
+	}
+
+	// PDF export
+	if r.Method == http.MethodGet && strings.HasSuffix(id, ".pdf") {
+		h.handlePDFExport(w, r, did, handle, strings.TrimSuffix(id, ".pdf"))
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+
+	switch r.Method {
+	case http.MethodGet:
+		h.handleGetDoc(w, r, did, handle, id)
+	case http.MethodPut:
+		h.handleUpdateDoc(w, r, did, id)
+	case http.MethodDelete:
+		h.handleDeleteDoc(w, r, did, id)
+	default:
+		w.WriteHeader(http.StatusMethodNotAllowed)
+	}
+}
+
+func (h *Handler) handleDevDoc(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	id := strings.TrimPrefix(r.URL.Path, "/docs/")
+	if id == "" {
+		w.WriteHeader(http.StatusBadRequest)
+		return
+	}
+	sid := h.deps.GetSessionID(w, r)
+	store := h.deps.DevStore.GetSession(sid)
+	switch r.Method {
+	case http.MethodGet:
+		if strings.HasSuffix(id, ".pdf") {
+			baseID := strings.TrimSuffix(id, ".pdf")
+			d, ok := store[baseID]
+			if !ok {
+				http.Error(w, "not found", http.StatusNotFound)
+				return
+			}
+			name := fallback(d.Name, "Untitled")
+			blocks := fountain.Parse(d.Text)
+			pdfBytes, err := h.deps.RenderPDF(blocks, name)
+			if err != nil {
+				http.Error(w, "PDF render failed", http.StatusInternalServerError)
+				return
+			}
+			safeName := h.deps.SanitizeFilename(name)
+			w.Header().Del("Content-Type")
+			w.Header().Set("Content-Type", "application/pdf")
+			w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s.pdf\"", safeName))
+			w.Header().Set("Cache-Control", "no-store, no-cache, must-revalidate, max-age=0")
+			w.Header().Set("Pragma", "no-cache")
+			w.Header().Set("Expires", "0")
+			_, _ = w.Write(pdfBytes)
+			return
+		}
+		if strings.HasSuffix(id, ".fountain") {
+			baseID := strings.TrimSuffix(id, ".fountain")
+			d, ok := store[baseID]
+			if !ok {
+				http.Error(w, "not found", http.StatusNotFound)
+				return
+			}
+			name := fallback(d.Name, "screenplay")
+			w.Header().Del("Content-Type")
+			w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+			w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s.fountain\"", h.deps.SanitizeFilename(name)))
+			_, _ = w.Write([]byte(d.Text))
+			return
+		}
+		if r.URL.Query().Get("action") == "delete" {
+			if _, ok := store[id]; !ok {
+				http.Error(w, "not found", http.StatusNotFound)
+				return
+			}
+			delete(store, id)
+			http.Redirect(w, r, "/library", http.StatusSeeOther)
+			return
+		}
+		d, ok := store[id]
+		if !ok {
+			http.Error(w, "not found", http.StatusNotFound)
+			return
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{"id": d.ID, "name": d.Name, "text": d.Text, "updatedAt": d.UpdatedAt})
+	case http.MethodPut:
+		var body struct {
+			Name *string `json:"name"`
+			Text *string `json:"text"`
+		}
+		r.Body = http.MaxBytesReader(w, r.Body, h.deps.MaxJSONBody)
+		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+			http.Error(w, "invalid json", http.StatusBadRequest)
+			return
+		}
+		d, ok := store[id]
+		if !ok {
+			http.Error(w, "not found", http.StatusNotFound)
+			return
+		}
+		if body.Name != nil {
+			n := strings.TrimSpace(*body.Name)
+			if n == "" {
+				n = "Untitled"
+			}
+			d.Name = n
+		}
+		if body.Text != nil {
+			d.Text = *body.Text
+		}
+		d.UpdatedAt = time.Now().UTC().Format(time.RFC3339)
+		w.WriteHeader(http.StatusNoContent)
+	case http.MethodDelete:
+		if _, ok := store[id]; !ok {
+			http.Error(w, "not found", http.StatusNotFound)
+			return
+		}
+		delete(store, id)
+		w.WriteHeader(http.StatusNoContent)
+	default:
+		w.WriteHeader(http.StatusMethodNotAllowed)
+	}
+}
+
+func (h *Handler) handlePDFExport(w http.ResponseWriter, r *http.Request, did, handle, id string) {
+	s2 := session.Session{DID: did, Handle: handle}
+	name, text, status, err := h.deps.FetchDoc(w, r, r.Context(), s2, id)
+	if err != nil {
+		w.WriteHeader(status)
+		return
+	}
+	if name == "" {
+		name = "Untitled"
+	}
+	blocks := fountain.Parse(text)
+	pdfBytes, err := h.deps.RenderPDF(blocks, name)
+	if err != nil {
+		http.Error(w, "PDF render failed", http.StatusInternalServerError)
+		return
+	}
+	safeName := h.deps.SanitizeFilename(name)
+	w.Header().Set("Content-Type", "application/pdf")
+	w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s.pdf\"", safeName))
+	w.Header().Set("Cache-Control", "no-store, no-cache, must-revalidate, max-age=0")
+	w.Header().Set("Pragma", "no-cache")
+	w.Header().Set("Expires", "0")
+	_, _ = w.Write(pdfBytes)
+}
+
+func (h *Handler) handleGetDoc(w http.ResponseWriter, r *http.Request, did, handle, id string) {
+	s2 := session.Session{DID: did, Handle: handle}
+	if strings.HasSuffix(id, ".fountain") {
+		baseID := strings.TrimSuffix(id, ".fountain")
+		name, text, status, err := h.deps.FetchDoc(w, r, r.Context(), s2, baseID)
+		if err != nil {
+			w.WriteHeader(status)
+			return
+		}
+		w.Header().Del("Content-Type")
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		if name == "" {
+			name = "screenplay"
+		}
+		w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s.fountain\"", h.deps.SanitizeFilename(name)))
+		_, _ = w.Write([]byte(text))
+		return
+	}
+
+	if r.URL.Query().Get("action") == "delete" {
+		delPayload := map[string]any{"repo": did, "collection": "lol.tapapp.tap.doc", "rkey": id}
+		dbuf, _ := json.Marshal(delPayload)
+		delURL := h.deps.PDSBase(r) + "/xrpc/com.atproto.repo.deleteRecord"
+		dRes, err := h.deps.PDSRequest(w, r, http.MethodPost, delURL, "application/json", dbuf)
+		if err != nil {
+			http.Error(w, "delete failed", http.StatusBadGateway)
+			return
+		}
+		defer dRes.Body.Close()
+		if dRes.StatusCode < 200 || dRes.StatusCode >= 300 {
+			w.WriteHeader(dRes.StatusCode)
+			return
+		}
+		http.Redirect(w, r, "/library", http.StatusSeeOther)
+		return
+	}
+
+	name, text, status, err := h.deps.FetchDoc(w, r, r.Context(), s2, id)
+	if err != nil {
+		w.WriteHeader(status)
+		return
+	}
+	_ = json.NewEncoder(w).Encode(map[string]any{"id": id, "name": name, "text": text, "updatedAt": ""})
+}
+
+func (h *Handler) handleUpdateDoc(w http.ResponseWriter, r *http.Request, did, id string) {
+	r.Body = http.MaxBytesReader(w, r.Body, h.deps.MaxJSONBody)
+	var body struct {
+		Name *string `json:"name"`
+		Text *string `json:"text"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		http.Error(w, "invalid json", http.StatusBadRequest)
+		return
+	}
+
+	getURL := h.deps.PDSBase(r) + "/xrpc/com.atproto.repo.getRecord?repo=" + did + "&collection=lol.tapapp.tap.doc&rkey=" + id
+	gRes, err := h.deps.PDSRequest(w, r, http.MethodGet, getURL, "", nil)
+	if err != nil {
+		http.Error(w, "get failed", http.StatusBadGateway)
+		return
+	}
+	defer gRes.Body.Close()
+	if gRes.StatusCode == http.StatusNotFound {
+		http.Error(w, "not found", http.StatusNotFound)
+		return
+	}
+	if gRes.StatusCode < 200 || gRes.StatusCode >= 300 {
+		w.WriteHeader(gRes.StatusCode)
+		return
+	}
+	var cur struct {
+		Value map[string]any `json:"value"`
+	}
+	if err := json.NewDecoder(gRes.Body).Decode(&cur); err != nil {
+		http.Error(w, "decode current", http.StatusBadGateway)
+		return
+	}
+	name := fallbackString(cur.Value["name"], "Untitled")
+	var blob map[string]any
+	if v, ok := cur.Value["contentBlob"].(map[string]any); ok {
+		blob = v
+	}
+	if body.Name != nil {
+		name = fallback(strings.TrimSpace(*body.Name), "Untitled")
+	}
+	if body.Text != nil {
+		if len(*body.Text) > h.deps.MaxTextBytes {
+			http.Error(w, "text too large", http.StatusRequestEntityTooLarge)
+			return
+		}
+		ubRes, err := h.deps.UploadBlobWithRetry(w, r, []byte(*body.Text))
+		if err != nil {
+			http.Error(w, "blob upload failed", http.StatusBadGateway)
+			return
+		}
+		defer ubRes.Body.Close()
+		var ub struct {
+			Blob map[string]any `json:"blob"`
+		}
+		if err := json.NewDecoder(ubRes.Body).Decode(&ub); err != nil {
+			http.Error(w, "blob decode failed", http.StatusBadGateway)
+			return
+		}
+		blob = ub.Blob
+	} else if blob == nil {
+		ubRes, err := h.deps.UploadBlobWithRetry(w, r, []byte(""))
+		if err != nil {
+			http.Error(w, "blob upload failed", http.StatusBadGateway)
+			return
+		}
+		defer ubRes.Body.Close()
+		var ub struct {
+			Blob map[string]any `json:"blob"`
+		}
+		if err := json.NewDecoder(ubRes.Body).Decode(&ub); err != nil {
+			http.Error(w, "blob decode failed", http.StatusBadGateway)
+			return
+		}
+		blob = ub.Blob
+	}
+
+	record := map[string]any{"$type": "lol.tapapp.tap.doc", "name": name, "contentBlob": blob, "updatedAt": time.Now().UTC().Format(time.RFC3339Nano)}
+	putPayload := map[string]any{"repo": did, "collection": "lol.tapapp.tap.doc", "rkey": id, "record": record}
+	pbuf, _ := json.Marshal(putPayload)
+	putURL := h.deps.PDSBase(r) + "/xrpc/com.atproto.repo.putRecord"
+	pRes, err := h.deps.PDSRequest(w, r, http.MethodPost, putURL, "application/json", pbuf)
+	if err != nil {
+		http.Error(w, "put failed", http.StatusBadGateway)
+		return
+	}
+	defer pRes.Body.Close()
+	if pRes.StatusCode < 200 || pRes.StatusCode >= 300 {
+		w.WriteHeader(pRes.StatusCode)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func (h *Handler) handleDeleteDoc(w http.ResponseWriter, r *http.Request, did, id string) {
+	delPayload := map[string]any{"repo": did, "collection": "lol.tapapp.tap.doc", "rkey": id}
+	dbuf, _ := json.Marshal(delPayload)
+	delURL := h.deps.PDSBase(r) + "/xrpc/com.atproto.repo.deleteRecord"
+	dRes, err := h.deps.PDSRequest(w, r, http.MethodPost, delURL, "application/json", dbuf)
+	if err != nil {
+		http.Error(w, "delete failed", http.StatusBadGateway)
+		return
+	}
+	defer dRes.Body.Close()
+	if dRes.StatusCode < 200 || dRes.StatusCode >= 300 {
+		w.WriteHeader(dRes.StatusCode)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func firstNonEmpty(values ...any) string {
+	for _, v := range values {
+		if s, ok := v.(string); ok && s != "" {
+			return s
+		}
+	}
+	return ""
+}
+
+func normalizeTime(ts string) string {
+	if ts == "" {
+		return ""
+	}
+	if t, err := time.Parse(time.RFC3339Nano, ts); err == nil {
+		return t.UTC().Format(time.RFC3339)
+	}
+	if t, err := time.Parse(time.RFC3339, ts); err == nil {
+		return t.UTC().Format(time.RFC3339)
+	}
+	return ts
+}
+
+func extractID(rec map[string]any) string {
+	if v, ok := rec["rkey"].(string); ok && v != "" {
+		return v
+	}
+	if v, ok := rec["uri"].(string); ok {
+		parts := strings.Split(v, "/")
+		if len(parts) > 0 {
+			return parts[len(parts)-1]
+		}
+	}
+	return "current"
+}
+
+func fallback(value, fallbackVal string) string {
+	if strings.TrimSpace(value) == "" {
+		return fallbackVal
+	}
+	return value
+}
+
+func fallbackString(value any, fallbackVal string) string {
+	if s, ok := value.(string); ok && strings.TrimSpace(s) != "" {
+		return s
+	}
+	return fallbackVal
+}

server/handlers/pages/pages.go

···
+package pages
+
+import (
+    "net/http"
+
+    "github.com/johnluther/tap-editor/server/render"
+)
+
+// Handler serves simple static HTML pages rendered from templates.
+type Handler struct {
+    renderer *render.Renderer
+}
+
+// New creates a Handler with the provided renderer.
+func New(renderer *render.Renderer) *Handler {
+    return &Handler{renderer: renderer}
+}
+
+// Register attaches the page handlers to the mux.
+func (h *Handler) Register(mux *http.ServeMux) {
+    mux.HandleFunc("/", h.handleIndex)
+    mux.HandleFunc("/about", h.handleAbout)
+    mux.HandleFunc("/privacy", h.handlePrivacy)
+    mux.HandleFunc("/terms", h.handleTerms)
+    mux.HandleFunc("/library", h.handleLibrary)
+}
+
+func (h *Handler) handleIndex(w http.ResponseWriter, r *http.Request) {
+    data := struct{ Title string }{Title: "Tap - A Minimal Fountain Editor"}
+    h.renderer.Execute(w, "index.html", data)
+}
+
+func (h *Handler) handleAbout(w http.ResponseWriter, r *http.Request) {
+    data := struct{ Title string }{Title: "About Tap"}
+    h.renderer.Execute(w, "about.html", data)
+}
+
+func (h *Handler) handlePrivacy(w http.ResponseWriter, r *http.Request) {
+    data := struct{ Title string }{Title: "Privacy Policy"}
+    h.renderer.Execute(w, "privacy.html", data)
+}
+
+func (h *Handler) handleTerms(w http.ResponseWriter, r *http.Request) {
+    data := struct{ Title string }{Title: "Terms of Service"}
+    h.renderer.Execute(w, "terms.html", data)
+}
+
+func (h *Handler) handleLibrary(w http.ResponseWriter, r *http.Request) {
+    w.Header().Set("Cache-Control", "no-cache")
+    data := struct{ Title string }{Title: "Library - Tap"}
+    h.renderer.Execute(w, "library.html", data)
+}

server/oauth.go

···
-package main
-
-import (
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rand"
-	"crypto/sha256"
-	"crypto/x509"
-	"encoding/base64"
-	"encoding/json"
-	"encoding/pem"
-	"fmt"
-	"log"
-	"net/http"
-	"os"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/gorilla/sessions"
-	"github.com/lestrrat-go/jwx/v2/jwk"
-	oauth "tangled.sh/icyphox.sh/atproto-oauth"
-)
-
-const (
-    // Use a distinct cookie name for Gorilla sessions to avoid colliding with
-    // the legacy 'tap_session' cookie used by non-OAuth flows.
-    SessionName = "tap_oauth"
-	oauthScope  = "atproto transition:generic"
-)
-
-type OAuthRequest struct {
-	State               string
-	Handle              string
-	Did                 string
-	PdsUrl              string
-	PkceVerifier        string
-	PkceChallenge       string
-	DpopAuthserverNonce string
-	DpopPrivateJwk      string
-	AuthserverIss       string
-	ReturnUrl           string
-}
-
-// handleOAuthResume allows the client to repopulate the server-side OAuth session
-// after restarts by POSTing current token state. Body JSON:
-// {
-//   "did": "...",
-//   "handle": "...",
-//   "pdsUrl": "https://...",
-//   "tokenType": "DPoP",
-//   "scope": "atproto transition:generic",
-//   "accessJwt": "...",
-//   "refreshJwt": "...",
-//   "expiry": "RFC3339 timestamp" // optional
-// }
-func handleOAuthResume(w http.ResponseWriter, r *http.Request) {
-    if r.Method != http.MethodPost {
-        w.WriteHeader(http.StatusMethodNotAllowed)
-        return
-    }
-    if oauthManager == nil {
-        http.Error(w, "oauth not initialized", http.StatusInternalServerError)
-        return
-    }
-    r.Body = http.MaxBytesReader(w, r.Body, 32<<10) // 32 KiB
-    var in struct {
-        Did        string `json:"did"`
-        Handle     string `json:"handle"`
-        PdsUrl     string `json:"pdsUrl"`
-        TokenType  string `json:"tokenType"`
-        Scope      string `json:"scope"`
-        AccessJwt  string `json:"accessJwt"`
-        RefreshJwt string `json:"refreshJwt"`
-        Expiry     string `json:"expiry"`
-    }
-    if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
-        http.Error(w, "invalid json", http.StatusBadRequest)
-        return
-    }
-    if in.Did == "" || in.AccessJwt == "" {
-        http.Error(w, "missing did/accessJwt", http.StatusBadRequest)
-        return
-    }
-    var exp time.Time
-    if strings.TrimSpace(in.Expiry) != "" {
-        if t, err := time.Parse(time.RFC3339, in.Expiry); err == nil {
-            exp = t
-        }
-    }
-    sess := OAuthSession{
-        Did:        in.Did,
-        Handle:     in.Handle,
-        PdsUrl:     in.PdsUrl,
-        TokenType:  in.TokenType,
-        Scope:      in.Scope,
-        AccessJwt:  in.AccessJwt,
-        RefreshJwt: in.RefreshJwt,
-        Expiry:     exp,
-    }
-    // Save to memory and cookie
-    oauthManager.SaveSession(sess.Did, sess)
-    if err := oauthManager.SaveSessionToCookie(r, w, sess); err != nil {
-        http.Error(w, "failed to persist session", http.StatusInternalServerError)
-        return
-    }
-    w.WriteHeader(http.StatusNoContent)
-}
-
-// GetSessionFromCookie reconstructs an OAuthSession from the Gorilla cookie, if present.
-func (o *OAuthManager) GetSessionFromCookie(r *http.Request) (OAuthSession, bool) {
-    session, err := o.store.Get(r, SessionName)
-    if err != nil || session.IsNew {
-        return OAuthSession{}, false
-    }
-    did, _ := session.Values["did"].(string)
-    handle, _ := session.Values["handle"].(string)
-    pds, _ := session.Values["pds"].(string)
-    ttype, _ := session.Values["token_type"].(string)
-    scope, _ := session.Values["scope"].(string)
-    access, _ := session.Values["access_jwt"].(string)
-    refresh, _ := session.Values["refresh_jwt"].(string)
-    expStr, _ := session.Values["expiry"].(string)
-    var exp time.Time
-    if expStr != "" {
-        if t, err := time.Parse(time.RFC3339, expStr); err == nil {
-            exp = t
-        }
-    }
-    if did == "" || access == "" {
-        return OAuthSession{}, false
-    }
-    return OAuthSession{
-        Did:        did,
-        Handle:     handle,
-        PdsUrl:     pds,
-        TokenType:  ttype,
-        Scope:      scope,
-        AccessJwt:  access,
-        RefreshJwt: refresh,
-        Expiry:     exp,
-    }, true
-}
-
-// SaveSessionToCookie writes the OAuthSession fields into the Gorilla cookie for persistence.
-func (o *OAuthManager) SaveSessionToCookie(r *http.Request, w http.ResponseWriter, sess OAuthSession) error {
-    session, err := o.store.Get(r, SessionName)
-    if err != nil {
-        return err
-    }
-    session.Values["did"] = sess.Did
-    session.Values["handle"] = sess.Handle
-    session.Values["pds"] = sess.PdsUrl
-    session.Values["token_type"] = sess.TokenType
-    session.Values["scope"] = sess.Scope
-    session.Values["access_jwt"] = sess.AccessJwt
-    session.Values["refresh_jwt"] = sess.RefreshJwt
-    if !sess.Expiry.IsZero() {
-        session.Values["expiry"] = sess.Expiry.UTC().Format(time.RFC3339)
-    }
-    return session.Save(r, w)
-}
-
-// generateClientAssertion builds a private_key_jwt for token endpoint auth using ES256.
-// Claims:
-//
-//	iss = client_id
-//	sub = client_id
-//	aud = token endpoint URL
-//	iat = now, exp = now + 5 minutes
-//	jti = random
-func (o *OAuthManager) generateClientAssertion(clientID, tokenURL string) (string, error) {
-	now := time.Now().Unix()
-
-	// Random jti
-	jtiBytes := make([]byte, 16)
-	if _, err := rand.Read(jtiBytes); err != nil {
-		return "", fmt.Errorf("failed to generate jti: %w", err)
-	}
-	jti := base64.RawURLEncoding.EncodeToString(jtiBytes)
-
-	claims := map[string]any{
-		"iss": clientID,
-		"sub": clientID,
-		// Bluesky accepts either token endpoint or issuer; include both
-		"aud": []string{tokenURL, "https://bsky.social"},
-		"iat": now,
-		"exp": now + 300,
-		"jti": jti,
-	}
-
-	header := map[string]any{
-		"alg": "ES256",
-		"typ": "JWT",
-		"kid": o.jwksKid,
-	}
-
-	headerJSON, _ := json.Marshal(header)
-	payloadJSON, _ := json.Marshal(claims)
-	signingInput := base64.RawURLEncoding.EncodeToString(headerJSON) + "." + base64.RawURLEncoding.EncodeToString(payloadJSON)
-
-	// Sign with ES256
-	hash := sha256.Sum256([]byte(signingInput))
-	r, s, err := ecdsa.Sign(rand.Reader, o.privateKey, hash[:])
-	if err != nil {
-		return "", fmt.Errorf("failed to sign client assertion: %w", err)
-	}
-
-	rBytes := make([]byte, 32)
-	sBytes := make([]byte, 32)
-	r.FillBytes(rBytes)
-	s.FillBytes(sBytes)
-	signature := append(rBytes, sBytes...)
-	sigB64 := base64.RawURLEncoding.EncodeToString(signature)
-
-	return signingInput + "." + sigB64, nil
-}
-
-type OAuthSession struct {
-	Did                 string
-	Handle              string
-	PdsUrl              string
-	DpopAuthserverNonce string
-	AuthServerIss       string
-	DpopPrivateJwk      string
-	TokenType           string
-	Scope               string
-	AccessJwt           string
-	RefreshJwt          string
-	Expiry              time.Time
-}
-
-type OAuthManager struct {
-	store         *sessions.CookieStore
-	oauthRequests map[string]OAuthRequest
-	oauthSessions map[string]OAuthSession
-	mu            sync.RWMutex
-	jwks          string
-	clientURI     string
-	privateKey    *ecdsa.PrivateKey
-	jwksKid       string
-}
-
-var oauthManager *OAuthManager
-
-func initOAuth(clientURI string, cookieSecret string) {
-	jwks, privKey, kid := loadOrGenerateKey()
-	store := sessions.NewCookieStore([]byte(cookieSecret))
-	store.Options = &sessions.Options{
-		Path:     "/",
-		HttpOnly: true,
-		Secure:   strings.HasPrefix(clientURI, "https://"),
-		SameSite: http.SameSiteLaxMode,
-		MaxAge:   30 * 24 * 3600, // 30 days
-	}
-	oauthManager = &OAuthManager{
-		store:         store,
-		oauthRequests: make(map[string]OAuthRequest),
-		oauthSessions: make(map[string]OAuthSession),
-		jwks:          jwks,
-		clientURI:     clientURI,
-		privateKey:    privKey,
-		jwksKid:       kid,
-	}
-}
-
-// loadOrGenerateKey loads an ES256 private key from env (PEM) or generates a new one.
-// It returns a JWKS (with alg/use/kid), the private key, and a stable kid based on the JWK thumbprint.
-func loadOrGenerateKey() (string, *ecdsa.PrivateKey, string) {
-	// Prefer a persistent PEM key from env
-	if pemStr := os.Getenv("OAUTH_ES256_PRIVATE_KEY_PEM"); pemStr != "" {
-		data := []byte(pemStr)
-		// Allow base64-encoded PEM content if it doesn't include BEGIN header
-		if !strings.Contains(pemStr, "-----BEGIN") {
-			if dec, err := base64.StdEncoding.DecodeString(pemStr); err == nil {
-				data = dec
-			}
-		}
-		blk, _ := pem.Decode(data)
-		if blk == nil {
-			log.Fatal("failed to decode OAUTH_ES256_PRIVATE_KEY_PEM: invalid PEM block")
-		}
-		// Try SEC1 EC private key
-		if pk, err := x509.ParseECPrivateKey(blk.Bytes); err == nil {
-			jwks, kid := jwksFromPrivateKey(pk)
-			return jwks, pk, kid
-		}
-		// Try PKCS#8 private key and cast to ECDSA
-		if pkAny, err := x509.ParsePKCS8PrivateKey(blk.Bytes); err == nil {
-			if ecdsaKey, ok := pkAny.(*ecdsa.PrivateKey); ok {
-				jwks, kid := jwksFromPrivateKey(ecdsaKey)
-				return jwks, ecdsaKey, kid
-			}
-			log.Fatal("OAUTH_ES256_PRIVATE_KEY_PEM is PKCS#8 but not an ECDSA key")
-		}
-		log.Fatal("failed to parse OAUTH_ES256_PRIVATE_KEY_PEM as EC or PKCS#8 ECDSA key")
-	}
-	// Fallback: generate ephemeral key
-	privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	if err != nil {
-		log.Fatal("failed to generate key:", err)
-	}
-	jwks, kid := jwksFromPrivateKey(privKey)
-	return jwks, privKey, kid
-}
-
-// jwksFromPrivateKey creates a JWKS JSON string and stable kid from the given key.
-func jwksFromPrivateKey(privKey *ecdsa.PrivateKey) (string, string) {
-	pubKey := &privKey.PublicKey
-	key, err := jwk.FromRaw(pubKey)
-	if err != nil {
-		log.Fatal("failed to create jwk from public key:", err)
-	}
-	// Compute a stable kid from the uncompressed EC public key bytes
-	// Uncompressed form per SEC1: 0x04 || X(32) || Y(32)
-	xb := pubKey.X.Bytes()
-	yb := pubKey.Y.Bytes()
-	// left-pad to 32 bytes
-	if len(xb) < 32 {
-		px := make([]byte, 32)
-		copy(px[32-len(xb):], xb)
-		xb = px
-	}
-	if len(yb) < 32 {
-		py := make([]byte, 32)
-		copy(py[32-len(yb):], yb)
-		yb = py
-	}
-	raw := make([]byte, 1+32+32)
-	raw[0] = 0x04
-	copy(raw[1:33], xb)
-	copy(raw[33:], yb)
-	sum := sha256.Sum256(raw)
-	kid := base64.RawURLEncoding.EncodeToString(sum[:])
-	if err := key.Set(jwk.KeyIDKey, kid); err != nil {
-		log.Fatal("failed to set kid:", err)
-	}
-	if err := key.Set("use", "sig"); err != nil {
-		log.Fatal("failed to set use:", err)
-	}
-	if err := key.Set("alg", "ES256"); err != nil {
-		log.Fatal("failed to set alg:", err)
-	}
-	jwks := map[string]interface{}{
-		"keys": []interface{}{key},
-	}
-	b, err := json.Marshal(jwks)
-	if err != nil {
-		log.Fatal("failed to marshal jwks:", err)
-	}
-	return string(b), kid
-}
-
-// generatePKCE generates a PKCE code verifier and challenge
-func generatePKCE() (verifier, challenge string, err error) {
-	// Generate random verifier (43-128 characters)
-	verifierBytes := make([]byte, 32)
-	if _, err := rand.Read(verifierBytes); err != nil {
-		return "", "", err
-	}
-
-	// Base64url encode the verifier
-	verifier = base64.RawURLEncoding.EncodeToString(verifierBytes)
-
-	// Create challenge by SHA256 hashing the verifier
-	hash := sha256.Sum256([]byte(verifier))
-	challenge = base64.RawURLEncoding.EncodeToString(hash[:])
-
-	return verifier, challenge, nil
-}
-
-// generateDPoPProof generates a DPoP proof for the given HTTP method and URL
-func (o *OAuthManager) generateDPoPProof(httpMethod, httpUri string, nonce ...string) (string, error) {
-	// Back-compat wrapper: no access-token hash (ath)
-	return o.generateDPoPProofWithToken(httpMethod, httpUri, "", nonce...)
-}
-
-// generateDPoPProofWithToken generates a DPoP proof and optionally includes 'ath' (SHA-256 of access token)
-func (o *OAuthManager) generateDPoPProofWithToken(httpMethod, httpUri, accessToken string, nonce ...string) (string, error) {
-	log.Printf("DPoP: Generating DPoP proof using standard JWT approach")
-
-	now := time.Now().Unix()
-
-	// Create DPoP claims as a simple map
-	// Generate a unique JWT ID (jti) to prevent replay attacks
-	jtiBytes := make([]byte, 16)
-	if _, err := rand.Read(jtiBytes); err != nil {
-		log.Printf("DPoP: ERROR - failed to generate jti: %v", err)
-		return "", fmt.Errorf("failed to generate jti: %w", err)
-	}
-	jti := base64.RawURLEncoding.EncodeToString(jtiBytes)
-
-	claims := map[string]interface{}{
-		"iat": now,
-		"htu": httpUri,
-		"htm": httpMethod,
-		"jti": jti,
-	}
-	// Optionally include 'ath' = base64url(SHA-256(access_token)) to bind token to proof
-	if accessToken != "" {
-		athHash := sha256.Sum256([]byte(accessToken))
-		claims["ath"] = base64.RawURLEncoding.EncodeToString(athHash[:])
-	}
-
-	// Add nonce if provided
-	if len(nonce) > 0 && nonce[0] != "" {
-		claims["nonce"] = nonce[0]
-		log.Printf("DPoP: Added nonce to claims: %s", nonce[0])
-	}
-
-	// Create JWK from our public key
-	pubKey := &o.privateKey.PublicKey
-	jwkKey, err := jwk.FromRaw(pubKey)
-	if err != nil {
-		log.Printf("DPoP: ERROR - failed to create JWK: %v", err)
-		return "", fmt.Errorf("failed to create JWK: %w", err)
-	}
-
-	// Set key ID
-	kid := fmt.Sprintf("%d", time.Now().Unix())
-	if err := jwkKey.Set(jwk.KeyIDKey, kid); err != nil {
-		log.Printf("DPoP: ERROR - failed to set kid: %w", err)
-		return "", fmt.Errorf("failed to set kid: %w", err)
-	}
-
-	// Convert JWK to JSON for header
-	jwkJSON, err := json.Marshal(jwkKey)
-	if err != nil {
-		log.Printf("DPoP: ERROR - failed to marshal JWK: %v", err)
-		return "", fmt.Errorf("failed to marshal JWK: %w", err)
-	}
-
-	log.Printf("DPoP: JWK JSON: %s", string(jwkJSON))
-
-	// Create JWT header with JWK
-	header := map[string]interface{}{
-		"typ": "dpop+jwt",
-		"alg": "ES256",
-		"jwk": json.RawMessage(jwkJSON),
-	}
-
-	// Encode header and payload
-	headerJSON, _ := json.Marshal(header)
-	payloadJSON, _ := json.Marshal(claims)
-
-	headerB64 := base64.RawURLEncoding.EncodeToString(headerJSON)
-	payloadB64 := base64.RawURLEncoding.EncodeToString(payloadJSON)
-
-	// Create signing input
-	signingInput := headerB64 + "." + payloadB64
-	log.Printf("DPoP: Signing input: %s", signingInput)
-
-	// Use ECDSA signing with proper hash
-	hash := sha256.Sum256([]byte(signingInput))
-	r, s, err := ecdsa.Sign(rand.Reader, o.privateKey, hash[:])
-	if err != nil {
-		log.Printf("DPoP: ERROR - failed to sign: %v", err)
-		return "", fmt.Errorf("failed to sign: %w", err)
-	}
-
-	// Convert to JWT ES256 format: r and s as 32-byte big-endian
-	rBytes := make([]byte, 32)
-	sBytes := make([]byte, 32)
-	r.FillBytes(rBytes)
-	s.FillBytes(sBytes)
-
-	signature := append(rBytes, sBytes...)
-	signatureB64 := base64.RawURLEncoding.EncodeToString(signature)
-
-	// Combine into final JWT
-	jwtToken := signingInput + "." + signatureB64
-
-	log.Printf("DPoP: JWT created, length: %d", len(jwtToken))
-	log.Printf("DPoP: Full JWT: %s", jwtToken)
-
-	return jwtToken, nil
-}
-
-func (o *OAuthManager) ClientMetadata() map[string]interface{} {
-	clientID := fmt.Sprintf("%s/oauth/client-metadata.json", o.clientURI)
-	redirectURIs := []string{fmt.Sprintf("%s/oauth/callback", o.clientURI)}
-	jwksURI := fmt.Sprintf("%s/oauth/jwks.json", o.clientURI)
-
-	return map[string]interface{}{
-		"client_id":                       clientID,
-		"client_name":                     "Tap App",
-		"subject_type":                    "public",
-		"client_uri":                      o.clientURI,
-		"redirect_uris":                   redirectURIs,
-		"grant_types":                     []string{"authorization_code", "refresh_token"},
-		"response_types":                  []string{"code"},
-		"application_type":                "web",
-		"dpop_bound_access_tokens":        true,
-		"jwks_uri":                        jwksURI,
-		"scope":                           oauthScope,
-		"token_endpoint_auth_method":      "private_key_jwt",
-		"token_endpoint_auth_signing_alg": "ES256",
-	}
-}
-
-func (o *OAuthManager) SaveRequest(state string, req OAuthRequest) {
-	o.mu.Lock()
-	defer o.mu.Unlock()
-	o.oauthRequests[state] = req
-}
-
-func (o *OAuthManager) GetRequest(state string) (OAuthRequest, bool) {
-	o.mu.RLock()
-	defer o.mu.RUnlock()
-	req, ok := o.oauthRequests[state]
-	return req, ok
-}
-
-func (o *OAuthManager) DeleteRequest(state string) {
-	o.mu.Lock()
-	defer o.mu.Unlock()
-	delete(o.oauthRequests, state)
-}
-
-func (o *OAuthManager) SaveSession(did string, sess OAuthSession) {
-	o.mu.Lock()
-	defer o.mu.Unlock()
-	o.oauthSessions[did] = sess
-}
-
-func (o *OAuthManager) GetSession(did string) (OAuthSession, bool) {
-	o.mu.RLock()
-	defer o.mu.RUnlock()
-	sess, ok := o.oauthSessions[did]
-	return sess, ok
-}
-
-func (o *OAuthManager) DeleteSession(did string) {
-	o.mu.Lock()
-	defer o.mu.Unlock()
-	delete(o.oauthSessions, did)
-}
-
-func (o *OAuthManager) GetUser(r *http.Request) *User {
-	session, err := o.store.Get(r, SessionName)
-	if err != nil || session.IsNew {
-		return nil
-	}
-
-	did, ok := session.Values["did"].(string)
-	if !ok || did == "" {
-		return nil
-	}
-
-	// Prefer in-memory session; otherwise, attempt to rehydrate from cookie
-	if sess, ok := o.GetSession(did); ok {
-		return &User{Handle: sess.Handle, Did: sess.Did, Pds: sess.PdsUrl}
-	}
-	if sess, ok := o.GetSessionFromCookie(r); ok {
-		// Cache it in memory for future lookups
-		o.SaveSession(sess.Did, sess)
-		return &User{Handle: sess.Handle, Did: sess.Did, Pds: sess.PdsUrl}
-	}
-	return &User{Did: did}
-}
-
-type User struct {
-	Handle string
-	Did    string
-	Pds    string
-}
-
-func (o *OAuthManager) AuthorizedClient(r *http.Request) (*oauth.XrpcClient, error) {
-	user := o.GetUser(r)
-	if user == nil {
-		return nil, fmt.Errorf("not authorized")
-	}
-
-	sess, ok := o.GetSession(user.Did)
-	if !ok {
-		return nil, fmt.Errorf("session not found")
-	}
-
-	// Check if token needs refresh
-	if time.Until(sess.Expiry) <= 5*time.Minute {
-		if err := o.refreshSession(user.Did); err != nil {
-			return nil, fmt.Errorf("failed to refresh session: %w", err)
-		}
-		sess, _ = o.GetSession(user.Did)
-	}
-
-	client := &oauth.XrpcClient{
-		OnDpopPdsNonceChanged: func(did, newNonce string) {
-			o.mu.Lock()
-			if s, ok := o.oauthSessions[did]; ok {
-				s.DpopAuthserverNonce = newNonce
-				o.oauthSessions[did] = s
-			}
-			o.mu.Unlock()
-		},
-	}
-
-	// For simplicity, return the client
-	// In full implementation, wrap with xrpc client
-	return client, nil
-}
-
-func (o *OAuthManager) refreshSession(did string) error {
-	sess, ok := o.GetSession(did)
-	if !ok {
-		return fmt.Errorf("session not found")
-	}
-
-	// For simplicity, assume we have the client
-	// In real implementation, need to create oauth client
-	// This is simplified
-
-	// Placeholder: in full implementation, use oauthClient.RefreshTokenRequest
-	// For now, just extend expiry
-	sess.Expiry = time.Now().Add(30 * time.Minute)
-	o.SaveSession(did, sess)
-
-	return nil
-}
-
-func (o *OAuthManager) ClearSession(r *http.Request, w http.ResponseWriter) error {
-	session, err := o.store.Get(r, SessionName)
-	if err != nil {
-		return err
-	}
-
-	did, ok := session.Values["did"].(string)
-	if ok {
-		o.DeleteSession(did)
-	}
-
-	session.Options.MaxAge = -1
-	return session.Save(r, w)
-}

server/render/render.go

···
+package render
+
+import (
+    "html/template"
+    "log"
+    "net/http"
+)
+
+// Renderer wraps parsed templates and provides helper methods for rendering
+// server-side views.
+type Renderer struct {
+    templates *template.Template
+}
+
+// New creates a Renderer from a glob pattern (e.g. "templates/*.html").
+func New(pattern string) (*Renderer, error) {
+    tmpl, err := template.ParseGlob(pattern)
+    if err != nil {
+        return nil, err
+    }
+    return &Renderer{templates: tmpl}, nil
+}
+
+// Execute renders the named template with the provided data to the ResponseWriter.
+func (r *Renderer) Execute(w http.ResponseWriter, name string, data any) {
+    w.Header().Set("Content-Type", "text/html; charset=utf-8")
+    if err := r.templates.ExecuteTemplate(w, name, data); err != nil {
+        log.Printf("render %s: %v", name, err)
+        w.WriteHeader(http.StatusInternalServerError)
+        _, _ = w.Write([]byte("Template error"))
+    }
+}

server/session/session.go

···
+package session
+
+import "sync"
+
+// Session represents a minimal legacy session persisted via cookie for
+// non-OAuth flows and for compatibility with older endpoints.
+type Session struct {
+    DID        string `json:"did"`
+    Handle     string `json:"handle"`
+    AccessJWT  string `json:"accessJwt,omitempty"`
+    RefreshJWT string `json:"refreshJwt,omitempty"`
+}
+
+// Store wraps the legacy session map with a mutex to provide safe concurrent
+// access. It retains the in-memory behaviour used previously in main.go.
+type Store struct {
+    mu   sync.RWMutex
+    data map[string]Session
+}
+
+// NewStore returns an initialised Store ready for use.
+func NewStore() *Store {
+    return &Store{data: make(map[string]Session)}
+}
+
+// Get returns the session associated with id, if present.
+func (s *Store) Get(id string) (Session, bool) {
+    s.mu.RLock()
+    defer s.mu.RUnlock()
+    val, ok := s.data[id]
+    return val, ok
+}
+
+// Set stores the session for the given id, replacing any previous entry.
+func (s *Store) Set(id string, sess Session) {
+    s.mu.Lock()
+    s.data[id] = sess
+    s.mu.Unlock()
+}
+
+// Delete removes any session associated with id.
+func (s *Store) Delete(id string) {
+    s.mu.Lock()
+    delete(s.data, id)
+    s.mu.Unlock()
+}
+
+// Keys exposes a snapshot of the current session IDs for debugging/tests.
+func (s *Store) Keys() []string {
+    s.mu.RLock()
+    defer s.mu.RUnlock()
+    keys := make([]string, 0, len(s.data))
+    for k := range s.data {
+        keys = append(keys, k)
+    }
+    return keys
+}